CVE-2026-20407: MediaTek WLAN STA driver - local privilege escalation via out-of-bounds write
CVE-2026-20407 is a flaw in the MediaTek WLAN STA driver caused by a missing bounds check, classified as CWE-787 (out-of-bounds write). The vendor-derived description states that it allows local privilege escalation with user-level execution and no user interaction, and NVD records a CVSS 3.1 base score of 9.3 (critical). The record lists no fixed version and no confirmed exploitation, so administrators should check the MediaTek February 2026 bulletin for the builds they run.
Overview The CVE record CVE-2026-20407 describes a possible escalation of privilege in the wlan STA driver caused by a missing bounds check. The CWE classification assigned in the record is CWE-787, Out-of-bounds Write. The record cites the MediaTek product security bulletin for February 2026 as its vendor reference and was published on 2026-02-02 with source status Analyzed. ## Impact According to the record, a local actor able to run code with user-level privileges could escalate privileges, and no user interaction is needed. NVD assigns a CVSS 3.1 base score of 9.3 with local attack vector, low complexity, no privileges required, no user interaction, changed scope and high impact to confidentiality, integrity and availability. Because the scope is recorded as changed, the effects may extend beyond the vulnerable driver component, which is an inference from the vector string. ## Affected products and versions - The record lists the product Mediatek Nbiot Sdk with versions ≤ 3.8. - The description refers to the wlan STA driver, which does not clearly match an NB-IoT SDK product name, so the mapping should be confirmed with the vendor bulletin. - No fixed version is listed in the record. ## Exploitation status The KEV catalog flag in this record is false, so this CVE is not recorded there as actively exploited. No confirmed exploitation appears in the sources consulted, and no EPSS score is available in the record. ## Remediation and mitigation - Check the MediaTek February 2026 bulletin for the fixed build that corresponds to your device, chipset and SDK version. - Apply vendor-provided updates or patches, including the patch identified in the record as WCNCR00464377, once you confirm they apply to your build. - Limit the execution of untrusted local code on affected devices and keep the principle of least privilege for user accounts and services. - Maintain an inventory of devices and SDK builds that include MediaTek wireless components so that patch status can be tracked. ## Detection guidance - Monitor endpoints and embedded devices for unexpected privilege changes, unusual process elevation and abnormal driver or kernel crashes. - Review system logs for wireless driver faults around the time of suspicious local activity. - Treat these indicators as general signals only; the record does not describe specific artifacts to look for. ## Limitations of the available information The record does not include a fixed version, vendor-supplied CVSS data beyond the listed provider, an EPSS score, an SSVC result or a title from the CNA. The description mentions the user execution requirement while the CVSS vector records no privileges required, and the affected product name differs from the driver named in the description. These points should be resolved with the vendor bulletin before making deployment decisions.
Frequently asked questions
What is CVE-2026-20407?
It is a MediaTek-reported flaw in the WLAN STA driver caused by a missing bounds check, classified as CWE-787 out-of-bounds write, which the record describes as enabling local privilege escalation.
Is CVE-2026-20407 known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which version is fixed?
The record does not list a fixed version. Check the MediaTek February 2026 bulletin for the build that applies to your device.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.